Changeset 163391 in webkit for trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

Timestamp:

Feb 4, 2014, 11:09:52 AM (12 years ago)

Author:

[email protected]

Message:

ASSERT in speculateMachineInt on 32-bit platforms
​https://bugs.webkit.org/show_bug.cgi?id=128155

Reviewed by Filip Pizlo.

• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

File:

• trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

@@ -136 +136 @@
         case WeakJSConstant: {
             SpeculatedType type = speculationFromValue(m_graph.valueOfJSConstant(node));
-            if (type == SpecInt52AsDouble)
+            if (type == SpecInt52AsDouble && enableInt52())
                 type = SpecInt52;
             changed |= setPrediction(type);